diff --git a/bcel-5.2-encoding.patch b/bcel-5.2-encoding.patch deleted file mode 100644 index 7b9a3fa..0000000 --- a/bcel-5.2-encoding.patch +++ /dev/null @@ -1,11 +0,0 @@ ---- bcel-5.2/build.xml 2017-09-27 18:59:57.110434113 +0200 -+++ bcel-5.2/build.xml 2017-09-27 19:00:39.286692143 +0200 -@@ -39,7 +39,7 @@ - - - -- -+ - - - diff --git a/bcel-5.2-src.tar.gz b/bcel-5.2-src.tar.gz deleted file mode 100644 index a037357..0000000 --- a/bcel-5.2-src.tar.gz +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:68039d59a38379d7b65ea3fc72276c43ba234776460e14361af35771bcaab295 -size 261455 diff --git a/bcel-5.2-src.tar.gz.asc b/bcel-5.2-src.tar.gz.asc deleted file mode 100644 index 0278a01..0000000 --- a/bcel-5.2-src.tar.gz.asc +++ /dev/null @@ -1,7 +0,0 @@ ------BEGIN PGP SIGNATURE----- -Version: GnuPG v1.4.3 (Darwin) - -iD8DBQBEhYtsBGM6V3wgCUERApQvAKCS9aZhwXPt08teiwlBFuDFs7Rq3ACfSQDg -4lsgidm/aPrmx48f7SseOoE= -=SPdZ ------END PGP SIGNATURE----- diff --git a/bcel-5.2.pom b/bcel-5.2.pom deleted file mode 100644 index 20e1b11..0000000 --- a/bcel-5.2.pom +++ /dev/null @@ -1,21 +0,0 @@ - - - - 4.0.0 - - org.apache.bcel - bcel - jar - 5.2 - - - - jakarta-regexp - jakarta-regexp - 1.4 - - - - diff --git a/bcel-6.7.0-src.tar.gz b/bcel-6.7.0-src.tar.gz new file mode 100644 index 0000000..b87f680 --- /dev/null +++ b/bcel-6.7.0-src.tar.gz @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:dbaa634f3fc39d90779d2fc3ad686fe494909ff305326c7d073f9f7cce9588ca +size 1053400 diff --git a/bcel-CVE-2022-42920.patch b/bcel-CVE-2022-42920.patch deleted file mode 100644 index 02bb0a4..0000000 --- a/bcel-CVE-2022-42920.patch +++ /dev/null @@ -1,166 +0,0 @@ -From f3267cbcc900f80851d561bdd16b239d936947f5 Mon Sep 17 00:00:00 2001 -From: Richard Atkins -Date: Wed, 21 Sep 2022 23:18:58 +1000 -Subject: [PATCH] BCEL-363 Enforce MAX_CP_ENTRIES in ConstantPoolGen and - ConstantPool.dump (#147) - -* BCEL-363 Enforce MAX_CP_ENTRIES in ConstantPoolGen and ConstantPool.dump - -* BCEL-363 Add test coverage for enforced size limit - -* BCEL-363 Throw IllegalStateException instead of RuntimeException - -* BCEL-363 Use final ---- - .../org/apache/bcel/classfile/ConstantPool.java | 11 +++++++++-- - .../org/apache/bcel/generic/ConstantPoolGen.java | 11 ++++++++++- - .../bcel/classfile/ConstantPoolTestCase.java | 15 +++++++++++++++ - 3 files changed, 34 insertions(+), 3 deletions(-) - -Index: bcel/src/java/org/apache/bcel/classfile/ConstantPool.java -=================================================================== ---- bcel.orig/src/java/org/apache/bcel/classfile/ConstantPool.java -+++ bcel/src/java/org/apache/bcel/classfile/ConstantPool.java -@@ -198,10 +198,17 @@ public class ConstantPool implements Clo - * @throws IOException - */ - public void dump( DataOutputStream file ) throws IOException { -- file.writeShort(constant_pool_count); -- for (int i = 1; i < constant_pool_count; i++) { -- if (constant_pool[i] != null) { -- constant_pool[i].dump(file); -+ /* -+ * Constants over the size of the constant pool shall not be written out. -+ * This is a redundant measure as the ConstantPoolGen should have already -+ * reported an error back in the situation. -+ */ -+ final int size = Math.min(constant_pool.length, Constants.MAX_CP_ENTRIES); -+ -+ file.writeShort(size); -+ for (int i = 1; i < size; i++) { -+ if (constant_pool[i] != null) { -+ constant_pool[i].dump(file); - } - } - } -Index: bcel/src/java/org/apache/bcel/generic/ConstantPoolGen.java -=================================================================== ---- bcel.orig/src/java/org/apache/bcel/generic/ConstantPoolGen.java -+++ bcel/src/java/org/apache/bcel/generic/ConstantPoolGen.java -@@ -50,14 +50,16 @@ import org.apache.bcel.classfile.Constan - */ - public class ConstantPoolGen implements java.io.Serializable { - -- protected int size = 1024; // Inital size, sufficient in most cases -- protected Constant[] constants = new Constant[size]; -- protected int index = 1; // First entry (0) used by JVM -+ private static final int DEFAULT_BUFFER_SIZE = 256; - private static final String METHODREF_DELIM = ":"; - private static final String IMETHODREF_DELIM = "#"; - private static final String FIELDREF_DELIM = "&"; - private static final String NAT_DELIM = "%"; - -+ protected int size = DEFAULT_BUFFER_SIZE; -+ protected Constant[] constants = new Constant[size]; -+ protected int index = 1; // First entry (0) used by JVM -+ - private static class Index implements java.io.Serializable { - - int index; -@@ -75,6 +76,8 @@ public class ConstantPoolGen implements - * @param cs array of given constants, new ones will be appended - */ - public ConstantPoolGen(Constant[] cs) { -+ -+ size = Math.min(Math.max(DEFAULT_BUFFER_SIZE, cs.length + 64), Constants.MAX_CP_ENTRIES + 1); - if (cs.length > size) { - size = cs.length; - constants = new Constant[size]; -@@ -156,9 +159,18 @@ public class ConstantPoolGen implements - /** Resize internal array of constants. - */ - protected void adjustSize() { -+ // 3 extra spaces are needed as some entries may take 3 slots -+ if (index + 3 >= Constants.MAX_CP_ENTRIES + 1) { -+ throw new IllegalStateException("The number of constants " + (index + 3) -+ + " is over the size of the constant pool: " -+ + Constants.MAX_CP_ENTRIES); -+ } -+ - if (index + 3 >= size) { - Constant[] cs = constants; - size *= 2; -+ // the constant array shall not exceed the size of the constant pool -+ size = Math.min(size, Constants.MAX_CP_ENTRIES + 1); - constants = new Constant[size]; - System.arraycopy(cs, 0, constants, 0, index); - } -Index: bcel/src/test/java/org/apache/bcel/ConstantPoolTestCase.java -=================================================================== ---- /dev/null -+++ bcel/src/test/java/org/apache/bcel/ConstantPoolTestCase.java -@@ -0,0 +1,64 @@ -+/* -+ * Licensed to the Apache Software Foundation (ASF) under one or more -+ * contributor license agreements. See the NOTICE file distributed with -+ * this work for additional information regarding copyright ownership. -+ * The ASF licenses this file to You under the Apache License, Version 2.0 -+ * (the "License"); you may not use this file except in compliance with -+ * the License. You may obtain a copy of the License at -+ * -+ * http://www.apache.org/licenses/LICENSE-2.0 -+ * -+ * Unless required by applicable law or agreed to in writing, software -+ * distributed under the License is distributed on an "AS IS" BASIS, -+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -+ * See the License for the specific language governing permissions and -+ * limitations under the License. -+ */ -+package org.apache.bcel.classfile; -+ -+import static org.junit.jupiter.api.Assertions.assertNotNull; -+import static org.junit.jupiter.api.Assertions.assertThrows; -+ -+import org.apache.bcel.AbstractTestCase; -+import org.apache.bcel.Const; -+import org.apache.bcel.generic.ConstantPoolGen; -+import org.apache.bcel.generic.InstructionHandle; -+import org.apache.bcel.generic.InstructionList; -+import org.apache.bcel.generic.MethodGen; -+import org.junit.jupiter.api.Test; -+public class ConstantPoolTestCase extends AbstractTestCase { -+ private InstructionHandle[] getInstructionHandles(final JavaClass clazz, final ConstantPoolGen cp, final Method method) { -+ final MethodGen methodGen = new MethodGen(method, clazz.getClassName(), cp); -+ final InstructionList instructionList = methodGen.getInstructionList(); -+ return instructionList.getInstructionHandles(); -+ } -+ @Test -+ public void testConstantToString() throws ClassNotFoundException { -+ final JavaClass clazz = getTestClass(PACKAGE_BASE_NAME + ".data.SimpleClassWithDefaultConstructor"); -+ final ConstantPoolGen cp = new ConstantPoolGen(clazz.getConstantPool()); -+ final Method[] methods = clazz.getMethods(); -+ for (final Method method : methods) { -+ if (method.getName().equals("")) { -+ for (final InstructionHandle instructionHandle : getInstructionHandles(clazz, cp, method)) { -+ final String string = instructionHandle.getInstruction().toString(cp.getConstantPool()); -+ assertNotNull(string); -+ // TODO Need real assertions. -+ // System.out.println(string); -+ } -+ } -+ } -+ } -+ -+ @Test -+ public void testTooManyConstants() throws ClassNotFoundException { -+ final JavaClass clazz = getTestClass(PACKAGE_BASE_NAME + ".data.SimpleClassWithDefaultConstructor"); -+ final ConstantPoolGen cp = new ConstantPoolGen(clazz.getConstantPool()); -+ -+ int i = cp.getSize(); -+ while (i < Constants.MAX_CP_ENTRIES - 1) { -+ cp.addLong(i); -+ i = cp.getSize(); // i += 2 -+ } -+ assertThrows(IllegalStateException.class, () -> cp.addLong(0)); -+ } -+} diff --git a/bcel-build.xml b/bcel-build.xml new file mode 100644 index 0000000..bac3349 --- /dev/null +++ b/bcel-build.xml @@ -0,0 +1,146 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/bcel.keyring b/bcel.keyring deleted file mode 100644 index 2a2a0f5..0000000 --- a/bcel.keyring +++ /dev/null @@ -1,40 +0,0 @@ -pub 1024D/7C200941 2004-04-24 -uid Torsten Curdt -uid [ revoked] Torsten Curdt -uid Torsten Curdt -uid [ revoked] Torsten Curdt -sub 1024g/87C5307C 2004-04-24 - ------BEGIN PGP PUBLIC KEY BLOCK----- -Version: GnuPG v2.0.19 (GNU/Linux) - -mQGiBECJuNYRBADaat2HMyxurx2WP1A30fBMrQSR+oUkmgb3bxcNthX5Ak/l88Ue -r5t/fXzBCMT8FOakMYotcDF05SYW6eB4fUk6IgGRr0qNdoPOnggYpJlFt0jogS9I -ZSuWi1wg0Ky8wXxSwXbza88k2zymeaJDAw6MkGZU6OJIfLqqMZxAINqJowCgmlg8 -MlrLmLoZe8mM3VWYNjOvne8D/iovOI/CNNoIcUBBK5zjnKjUow0J53r47CzlCq7Y -UWwgbkia547s5C1OD77vuhcL2yhSe+boamslGuUiFEjZlazsrdnFmveNt15QHS6F -enDnoAYvBEybiwgISfWslaMIXB8VzKjd2CxzOjqW+U4Zb8Eju7zHaS0T/W158dEg -xrsTA/9uI2BJsESYeDiTyEdKrkVbbp4r6INBaT2oUjV3O1l1KBwa1G24RaBV/TgW -7cUzTSNtwcPiOcqMK23JwjRIA4LNGTtXY2hALmVADFlxHVUasKBgUQyepnl1z0ow -uGOxV9CENgtv8nE8ToXnfUcNfrclFO+ryGwYPhC9yp9CgRxvQLQdVG9yc3RlbiBD -dXJkdCA8dGN1cmR0QHdlYi5kZT6IZQQwEQIAJQUCRIBI8x4dIG5vIGxvbmdlciB1 -c2luZyB0aGlzIGFkZHJlc3MACgkQBGM6V3wgCUGbXQCaAoHIhXbIn/Ra0SmZUHr5 -JG50El4AnR8lppNTVKEG40KfdNgo/Nl4uJ2EtCBUb3JzdGVuIEN1cmR0IDx0Y3Vy -ZHRAdmFmZXIub3JnPohmBBMRAgAeAhsDBgsJCAcDAgMVAgMDFgIBAh4BAheABQJB -Vcx+ABIJEARjOld8IAlBB2VHUEcAAQH1xACeJueowZiDbDHEG3TRIZeLpS73sswA -n0UnmGsNVLEYJ5FpMZZnsw4KtQr7tCFUb3JzdGVuIEN1cmR0IDx0Y3VyZHRAYXBh -Y2hlLm9yZz6IZgQTEQIAHgYLCQgHAwIDFQIDAxYCAQIeAQIXgAUCQVXMowIZAQAS -CRAEYzpXfCAJQQdlR1BHAAEB8bgAmwUYhsKJUJrhk1HqK5DAyO7/fXrRAJwK3lFg -gk80PzHFjxJIklZ54zvcULQlVG9yc3RlbiBDdXJkdCA8dGN1cmR0QG1hbmFnZXNv -ZnQuY29tPohJBDARAgAJBQJFeJgIAh0gAAoJEARjOld8IAlBO+sAoI4W2UE506cy -Z7HROWvfOajpWKURAJwL3+dX2GGiIPBPGU/hPlNlcMexKrkBDQRAibjYEAQAty+5 -SuEpdl51FhbDt3BPGTUO8lNLY55IXY/D6XeCxczVplKCRCXZqYEUeRbe02yjliDa -2VHJnirEdW2H24+g5SmIcUzhAHAEXm/zwfjE6wHQlv57Po+n2fV+BeoTszbZverK -jJxLfmq3Wf4vvRh4MCSfViefRw4YthOXAF/4xacAAwUD/jZZN52zLBp9liZfHpJ9 -AEQBMZWhxwrdY6ixugkUZTC0yp/2EB4sUxUYVMjnZXWaBcGWtEHmyWqXL7oEOyL1 -z7yaTYrt9F7CtYWRwyp5L5xHObxxES93o7uhXxm/bXFujP1SCE6XET4QU4N7zHEs -NpO0JUYx+msDVHqJmBnxZcGuiE4EGBECAAYFAkCJuNgAEgkQBGM6V3wgCUEHZUdQ -RwABAYEHAJwP4Up+XMkConqbrWLNDfQ2Gf8PuACeO2umjbwjOn2S67ze9UXBAEmi -D4Q= -=+1C3 ------END PGP PUBLIC KEY BLOCK----- diff --git a/bcel.spec b/bcel.spec index d2780e4..f4010a9 100644 --- a/bcel.spec +++ b/bcel.spec @@ -1,7 +1,7 @@ # # spec file for package bcel # -# Copyright (c) 2022 SUSE LLC +# Copyright (c) 2023 SUSE LLC # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -17,25 +17,19 @@ Name: bcel -Version: 5.2 +Version: 6.7.0 Release: 0 Summary: Byte Code Engineering Library License: Apache-2.0 Group: Development/Libraries/Java -URL: http://commons.apache.org/proper/commons-bcel/ -Source0: http://archive.apache.org/dist/commons/bcel/source/%{name}-%{version}-src.tar.gz -Source1: http://archive.apache.org/dist/commons/bcel/source/%{name}-%{version}-src.tar.gz.asc -Source2: http://repo.maven.apache.org/maven2/org/apache/%{name}/%{name}/%{version}/%{name}-%{version}.pom -Source3: bcel.keyring -Patch0: bcel-5.2-encoding.patch -#PATCH-FIX-UPSTREAM bsc#1205125 CVE-2022-42920 Out-of-bounds writing issue -Patch1: bcel-CVE-2022-42920.patch +URL: https://commons.apache.org/proper/commons-bcel/ +Source0: https://archive.apache.org/dist/commons/bcel/source/%{name}-%{version}-src.tar.gz +Source1: %{name}-build.xml BuildRequires: ant +BuildRequires: apache-commons-lang3 +BuildRequires: fdupes BuildRequires: java-devel >= 1.8 -BuildRequires: javapackages-local -BuildRequires: regexp -#!BuildIgnore: xalan-j2 xerces-j2 xml-apis xml-resolver -Requires: regexp +BuildRequires: javapackages-local >= 6 BuildArch: noarch %description @@ -60,36 +54,40 @@ It contains a byte code verifier named JustIce, which usually gives you much better information about what is wrong with your code than the standard JVM message. -%prep -%autosetup -p1 +%package javadoc +Summary: Javadoc for %{name} +Group: Documentation/HTML -# remove all binary libs -find . -name "*.jar" -exec rm -f {} \; -# very broken build -perl -p -i -e 's| depends=\"examples\"||g;' build.xml -touch manifest.txt +%description javadoc +This package contains the API documentation for %{name}. + +%prep +%setup -q -n %{name}-%{version}-src +cp %{SOURCE1} build.xml %build -export CLASSPATH=%(build-classpath regexp) -export OPT_JAR_LIST="ant/ant-nodeps" -ant \ - -Dant.build.javac.target=8 -Dant.build.javac.source=8 \ - -Dbuild.dest=./build -Dbuild.dir=./build -Dname=%{name} \ - compile jar +mkdir -p lib +build-jar-repository -s lib apache-commons-lang3 +%ant jar javadoc %install -# jars +# jar mkdir -p %{buildroot}%{_javadir} -install -m 644 target/%{name}-%{version}.jar %{buildroot}%{_javadir}/%{name}-%{version}.jar -(cd %{buildroot}%{_javadir} && for jar in *-%{version}*; do ln -s ${jar} `echo $jar| sed "s|-%{version}||g"`; done) - +install -m 644 target/%{name}-%{version}.jar %{buildroot}%{_javadir}/%{name}.jar +# pom mkdir -p %{buildroot}%{_mavenpomdir} -install -m 644 %{SOURCE2} %{buildroot}%{_mavenpomdir}/%{name}-%{version}.pom - -%add_maven_depmap %{name}-%{version}.pom %{name}-%{version}.jar -a "bcel:bcel" +%mvn_install_pom pom.xml %{buildroot}%{_mavenpomdir}/%{name}.pom +%add_maven_depmap %{name}.pom %{name}.jar -a "bcel:bcel" +# javadoc +# javadoc +mkdir -p %{buildroot}%{_javadocdir}/%{name} +cp -a target/site/apidocs/* %{buildroot}%{_javadocdir}/%{name} +%fdupes -s %{buildroot}%{_javadocdir}/%{name} %files -f .mfiles %license LICENSE.txt -%{_javadir}/* + +%files javadoc +%{_javadocdir}/%{name} %changelog